{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-F7E4C4C7",
  "slug": "cve-2026-85180-ollama-tensor-blob-redirect-ssrf",
  "title": "Ollama model pulls can SSRF internal hosts via blob redirects",
  "aliases": [
    "CVE-2026-85180",
    "Ollama tensor blob redirect SSRF"
  ],
  "summary": "Ollama 0.30.0 through 0.33.2 can follow cross-host tensor blob redirects during model pulls, enabling SSRF into internal hosts. Upgrade past the fixed release.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Confirm the exact fixed Ollama version against the live advisory for your install.",
  "firstObservedAt": "2026-09-03T00:00:00.000Z",
  "lastObservedAt": "2026-09-03T12:00:00.000Z",
  "publishedAt": "2026-09-20T19:30:53.582Z",
  "reviewedAt": "2026-09-20T19:30:48.341Z",
  "expiresAt": "2026-09-03T12:00:00.000Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "vulncheck",
      "label": "VulnCheck Ollama SSRF advisory",
      "url": "https://www.vulncheck.com/advisories/ollama-0.30.0-through-0.33.2-ssrf-via-cross-host-tensor-blob-redirect",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-09-03T12:00:00.000Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-85180",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85180",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-09-03T12:00:00.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-85180-ollama-tensor-blob-redirect-ssrf",
      "sourceType": "other_primary",
      "observedAt": "2026-09-03T12:00:00.000Z"
    }
  ],
  "artifacts": [
    {
      "id": "ollama",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "ollama",
      "version": "0.30.0 through 0.33.2",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "disclosure",
      "occurredAt": "2026-09-03T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-85180 Ollama tensor blob redirect SSRF disclosed.",
      "sourceIds": [
        "vulncheck",
        "nvd"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-09-03T12:00:00.000Z",
      "eventType": "other",
      "summary": "HOL Guard published operator coverage for CVE-2026-85180.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Affects Ollama 0.30.0 through 0.33.2 per advisory framing.",
    "Exact fixed build must be confirmed against live upstream advisory.",
    "HOL blog is operator guidance."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-85180-ollama-tensor-blob-redirect-ssrf/corrections"
}